﻿
/*
 * Copyright (C) Igor Sysoev
 * Copyright (C) Nginx, Inc.
 */

#ifndef _NGX_EVENT_SSL_H_INCLUDED_
#define _NGX_EVENT_SSL_H_INCLUDED_

#include <ngx_config.h>
#include <ngx_core.h>

#ifdef NGX_OPENSSL
#include "ngx_event_openssl.h"
#ifndef OPENSSL_VERSION_TEXT
#define OPENSSL_VERSION_TEXT "OPENSSL_VERSION"
#endif
#else
#include "ngx_event_hitls.h"
#ifndef OPENSSL_VERSION_TEXT
#define OPENSSL_VERSION_TEXT "OPENHITLS_VERSION"
#endif
#endif


typedef struct ngx_ssl_ocsp_s  ngx_ssl_ocsp_t;

struct ngx_ssl_s {
    ngx_ssl_ctx_t* ctx;
    ngx_log_t* log;
    size_t                      buffer_size;
    ngx_array_t* password;
    ngx_uint_t                  protocols;
    unsigned char               sm2PkeyPrvData[32];
#ifdef NGX_HITLS_SDF
    ngx_flag_t                  sdf;
    ngx_str_t                   sdf_lib_path;
    ngx_key_t                   *sdf_key;
#endif
};

struct ngx_ssl_connection_s {
    ngx_ssl_conn_t* connection;
    ngx_ssl_ctx_t* session_ctx;

    ngx_int_t                   last;
    ngx_buf_t* buf;
    size_t                      buffer_size;

    ngx_connection_handler_pt   handler;

    ngx_ssl_session_t* session;
    ngx_connection_handler_pt   save_session;

    ngx_event_handler_pt        saved_read_handler;
    ngx_event_handler_pt        saved_write_handler;

    ngx_ssl_ocsp_t* ocsp;

    u_char                      early_buf;

    ngx_str_t                   subject_dn;
    ngx_str_t                   issuer_dn;

    unsigned                    handshaked : 1;
    unsigned                    handshake_rejected : 1;
    unsigned                    renegotiation : 1;
    unsigned                    buffer : 1;
    unsigned                    sendfile : 1;
    unsigned                    no_wait_shutdown : 1;
    unsigned                    no_send_shutdown : 1;
    unsigned                    shutdown_without_free : 1;
    unsigned                    handshake_buffer_set : 1;
    unsigned                    session_timeout_set : 1;
    unsigned                    try_early_data : 1;
    unsigned                    in_early : 1;
    unsigned                    in_ocsp : 1;
    unsigned                    early_preread : 1;
    unsigned                    write_blocked : 1;
    unsigned                    is_client : 1;
};

#define NGX_SSL_NO_SCACHE            -2
#define NGX_SSL_NONE_SCACHE          -3
#define NGX_SSL_NO_BUILTIN_SCACHE    -4
#define NGX_SSL_DFLT_BUILTIN_SCACHE  -5


#define NGX_SSL_MAX_SESSION_SIZE  4096

typedef struct ngx_ssl_sess_id_s  ngx_ssl_sess_id_t;

struct ngx_ssl_sess_id_s {
    ngx_rbtree_node_t           node;
    size_t                      len;
    ngx_queue_t                 queue;
    time_t                      expire;
    u_char                      id[32];
#if (NGX_PTR_SIZE == 8)
    u_char* session;
#else
    u_char                      session[1];
#endif
};

typedef struct {
    u_char                      name[16];
    u_char                      hmac_key[32];
    u_char                      aes_key[32];
    time_t                      expire;
    unsigned                    size : 8;
    unsigned                    shared : 1;
} ngx_ssl_ticket_key_t;


typedef struct {
    ngx_rbtree_t                session_rbtree;
    ngx_rbtree_node_t           sentinel;
    ngx_queue_t                 expire_queue;
    ngx_ssl_ticket_key_t        ticket_keys[3];
    time_t                      fail_time;
} ngx_ssl_session_cache_t;


#define NGX_SSL_SSLv2    0x0002
#define NGX_SSL_SSLv3    0x0004
#define NGX_SSL_TLSv1    0x0008
#define NGX_SSL_TLSv1_1  0x0010
#define NGX_SSL_TLSv1_2  0x0020
#define NGX_SSL_TLSv1_3  0x0040
#define NGX_SSL_TLCP     0x0080


#define NGX_SSL_BUFFER   1
#define NGX_SSL_CLIENT   2

#define NGX_SSL_BUFSIZE  16384

ngx_int_t ngx_ssl_init(ngx_log_t* log);
ngx_int_t ngx_ssl_create(ngx_ssl_t* ssl, ngx_uint_t protocols, void* data);

ngx_int_t ngx_ssl_certificates(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_array_t* certs, ngx_array_t* keys, ngx_array_t* passwords);
ngx_int_t ngx_ssl_certificate(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_str_t* cert, ngx_str_t* key, ngx_array_t* passwords);
ngx_int_t ngx_ssl_connection_certificate(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* cert, ngx_str_t* key, ngx_array_t* passwords);

ngx_int_t ngx_ssl_ciphers(ngx_conf_t* cf, ngx_ssl_t* ssl, ngx_str_t* ciphers,
    ngx_uint_t prefer_server_ciphers);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_str_t* cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_str_t* cert, ngx_int_t depth);
ngx_int_t ngx_ssl_crl(ngx_conf_t* cf, ngx_ssl_t* ssl, ngx_str_t* crl);
ngx_int_t ngx_ssl_stapling(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_str_t* file, ngx_str_t* responder, ngx_uint_t verify);
ngx_int_t ngx_ssl_stapling_resolver(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_resolver_t* resolver, ngx_msec_t resolver_timeout);
ngx_int_t ngx_ssl_ocsp(ngx_conf_t* cf, ngx_ssl_t* ssl, ngx_str_t* responder,
    ngx_uint_t depth, ngx_shm_zone_t* shm_zone);
ngx_int_t ngx_ssl_ocsp_resolver(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_resolver_t* resolver, ngx_msec_t resolver_timeout);

ngx_int_t ngx_ssl_ocsp_validate(ngx_connection_t* c);
ngx_int_t ngx_ssl_ocsp_get_status(ngx_connection_t* c, const char** s);
void ngx_ssl_ocsp_cleanup(ngx_connection_t* c);
ngx_int_t ngx_ssl_ocsp_cache_init(ngx_shm_zone_t* shm_zone, void* data);

ngx_array_t* ngx_ssl_read_password_file(ngx_conf_t* cf, ngx_str_t* file);
ngx_array_t* ngx_ssl_preserve_passwords(ngx_conf_t* cf,
    ngx_array_t* passwords);
ngx_int_t ngx_ssl_dhparam(ngx_conf_t* cf, ngx_ssl_t* ssl, ngx_str_t* file);
ngx_int_t ngx_ssl_ecdh_curve(ngx_conf_t* cf, ngx_ssl_t* ssl, ngx_str_t* name);
ngx_int_t ngx_ssl_early_data(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_uint_t enable);
ngx_int_t ngx_ssl_conf_commands(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_array_t* commands);

ngx_int_t ngx_ssl_client_session_cache(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_uint_t enable);
ngx_int_t ngx_ssl_session_cache(ngx_ssl_t* ssl, ngx_str_t* sess_ctx,
    ngx_array_t* certificates, ssize_t builtin_session_cache,
    ngx_shm_zone_t* shm_zone, time_t timeout);
ngx_int_t ngx_ssl_session_ticket_keys(ngx_conf_t* cf, ngx_ssl_t* ssl,
    ngx_array_t* paths);
ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t* shm_zone, void* data);

ngx_int_t ngx_ssl_create_connection(ngx_ssl_t* ssl, ngx_connection_t* c,
    ngx_uint_t flags);

void ngx_ssl_remove_cached_session(ngx_ssl_ctx_t* ssl, ngx_ssl_session_t* sess);
ngx_int_t ngx_ssl_set_session(ngx_connection_t* c, ngx_ssl_session_t* session);
ngx_ssl_session_t* ngx_ssl_get_session(ngx_connection_t* c);
ngx_ssl_session_t* ngx_ssl_get0_session(ngx_connection_t* c);
void ngx_ssl_free_session(ngx_ssl_session_t* session);
void* ngx_ssl_get_connection(void* ssl_conn);
void* ngx_ssl_get_server_conf(void* ssl_ctx);

ngx_int_t ngx_ssl_check_host(ngx_connection_t* c, ngx_str_t* name);


ngx_int_t ngx_ssl_get_protocol(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_cipher_name(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_ciphers(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_curve(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_curves(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_session_id(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_session_reused(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_early_data(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_server_name(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_alpn_protocol(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_raw_certificate(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_certificate(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_escaped_certificate(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_subject_dn(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_issuer_dn(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_subject_dn_legacy(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_issuer_dn_legacy(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_serial_number(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_fingerprint(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_client_verify(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_client_v_start(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_client_v_end(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);
ngx_int_t ngx_ssl_get_client_v_remain(ngx_connection_t* c, ngx_pool_t* pool,
    ngx_str_t* s);

ngx_int_t ngx_ssl_handshake(ngx_connection_t* c);
#if (NGX_DEBUG)
void ngx_ssl_handshake_log(ngx_connection_t* c);
#endif
ssize_t ngx_ssl_recv(ngx_connection_t* c, u_char* buf, size_t size);
ssize_t ngx_ssl_write(ngx_connection_t* c, u_char* data, size_t size);
ssize_t ngx_ssl_recv_chain(ngx_connection_t* c, ngx_chain_t* cl, off_t limit);
ngx_chain_t* ngx_ssl_send_chain(ngx_connection_t* c, ngx_chain_t* in,
    off_t limit);
void ngx_ssl_free_buffer(ngx_connection_t* c);
ngx_int_t ngx_ssl_shutdown(ngx_connection_t* c);
void ngx_ssl_cleanup_ctx(void* data);

long ngx_ssl_get_verify_result(const ngx_ssl_conn_t* ssl);
const char* ngx_x509_verify_cert_error_string(long error_code);
ngx_x509_t* ngx_ssl_get_peer_certificate(const ngx_ssl_conn_t* ssl);
void ngx_x509_free(ngx_x509_t* x509);
ngx_ssl_session_t* ngx_d2i_ssl_session(ngx_ssl_session_t** a, const unsigned char** pp, long len);
int ngx_i2d_ssl_session(ngx_ssl_session_t* in, unsigned char** pp);
void ngx_ssl_write_handler(ngx_event_t* wev);
void ngx_ssl_read_handler(ngx_event_t* rev);
ssize_t ngx_ssl_sendfile(ngx_connection_t* c, ngx_buf_t* file, size_t size);

extern int  ngx_ssl_connection_index;
extern int  ngx_ssl_server_conf_index;
extern int  ngx_ssl_session_cache_index;
extern int  ngx_ssl_ticket_keys_index;
extern int  ngx_ssl_ocsp_index;
extern int  ngx_ssl_certificate_index;
extern int  ngx_ssl_next_certificate_index;
extern int  ngx_ssl_certificate_name_index;
extern int  ngx_ssl_stapling_index;

#endif